Aws IAM 组：在 Terraform 上设置对日志组的只读访问

Question

Does someone know how to setup read-only access to specific log groups?

resource "aws_iam_policy" "logs" {
  name        = "AWSLogs${title(var.product)}"
  description = "Logging policy for ${title(var.product)}"
  policy      = <<EOF
  {
        "Version": "2012-10-17",
        "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                    "logs:Get*",
                    "logs:List*",
                    "logs:Filter*"
                ],
                "Resource": [
                    "arn:aws:logs:::log-group:${aws_cloudwatch_log_group.one.arn}:log-stream:*",
                    "arn:aws:logs:::log-group:${aws_cloudwatch_log_group.two.arn}:log-stream:*",
                    "arn:aws:logs:::log-group:${aws_cloudwatch_log_group.three.arn}:log-stream:*"
                ]
            },
            {
                "Effect": "Allow",
                "Action": [
                    "logs:DescribeLogGroups"
                ],
                "Resource": "*"
            }
        ]
   }
EOF
}


resource "aws_iam_group_policy_attachment" "logs" {
  group      = "${aws_iam_group.logs.name}"
  policy_arn = "${aws_iam_policy.logs.arn}"
}

resource "aws_iam_group" "logs" {
  name = "${title(var.product)}Logs"
}

I'm currently struggeling to setup to only have access on specified log groups, but I can only get access to them when I set my resource to "*". This is not possible when I setup this dedicated to predefined log groups. Does someone have a good practice or solution? When I try this solution above I only get

Not authorized to perform: logs:FilterLogEvents, when I try to access it via an user which is part of the IAM group "logs".

Answer 1

aws_cloudwatch_log_group.one.arn already is the full ARN of the one log group, ie,

arn:aws:logs:us-east-1:123456789012:log-group:one

So refer only to that in the Resources list:

resource "aws_iam_policy" "logs" {
  name        = "AWSLogs${title(var.product)}"
  description = "Logging policy for ${title(var.product)}"
  policy      = <<EOF
  {
        "Version": "2012-10-17",
        "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                    "logs:Get*",
                    "logs:List*",
                    "logs:Filter*"
                ],
                "Resource": [
                    "${aws_cloudwatch_log_group.one.arn}:log-stream:*",
                    "${aws_cloudwatch_log_group.two.arn}:log-stream:*",
                    "${aws_cloudwatch_log_group.three.arn}:log-stream:*"
                ]
            },
            {
                "Effect": "Allow",
                "Action": [
                    "logs:DescribeLogGroups"
                ],
                "Resource": "*"
            }
        ]
   }
EOF
}

Answer 2

I was able to kind of solve this by adding a Condition filtering by tags to the Statement and making sure that the log groups and streams are tagged correspondingly:

"Condition": {
   "StringEquals": {
     "aws:ResourceTag/sometagname": "sometagvalue"
   }
}